CVE-2026-81726High· 8.7▾ TwilightA flaw was found in NLTK. This vulnerability, known as path traversal, allows an attacker to bypass security restrictions in the model-artifact APIs. By exploiting this, an attacker can perform unauthorized read or write operations on file…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
8.7 → 7
7 → 8.7
8.7 → 7
7 → 8.7
8.7 → 7
7 → 8.7
8.7 → 7
7 → 8.7
8.7 → 7
7 → 8.7
8.7 → 7
7 → 8.7
0.3% → 0.3%
Last analysed / modified upstream
A flaw was found in NLTK. This vulnerability, known as path traversal, allows an attacker to bypass security restrictions in the model-artifact APIs. By exploiting this, an attacker can perform unauthorized read or write operations on files outside the intended secure directories. This could lead to sensitive information disclosure or system compromise.
nltk: NLTK: Unauthorized file access via path traversal in model-artifact APIs — rated Important by Red Hat. Released 2026-08-27, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734
Workarounds / mitigations:
Affected packages:
nltk <= 3.10.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-79674High· 7.5nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors (CVE-2026-79674)
CVE-2026-81727High· 7.1nltk: NLTK: Filesystem containment bypass allows local file overwrite (CVE-2026-81727)
CVE-2026-76222High· 8.2gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names (CVE-2026-76222)
CVE-2026-19693High· 8.1extract-zip: extract-zip: Arbitrary file write via symlink in archive (CVE-2026-19693)
CVE-2026-66007Medium· 6.5datasets: Datasets: Information disclosure via path traversal vulnerability (CVE-2026-66007)
CVE-2026-12243High· 7.5Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.